Expires cookie if it could not be validated

[joelso]

@nilsok or @Florry please review

While testing I realized that old cookie where stuck in Postman, hence a Set-cookie with expired date was needed to get rid of it